Cookie details

Essential cookies

• synquara_cookie_consent — Remembers essential-only or your selected optional categories for 180 days. It contains no account identifiers.
• __Host-banana_session — An opaque server session identifier, sent only to this site. It is Secure, HttpOnly, SameSite=Lax, and has no Domain attribute. It expires no later than the current verified authentication token, usually one hour, and is renewed after authentication refresh. Without Remember me it is a browser-session cookie; with Remember me it has an explicit expiry. Signing out removes the cookie and its server record.

Secure means the browser sends a cookie only over HTTPS; it does not encrypt the cookie on your device. HttpOnly prevents JavaScript from reading that cookie. Session cookies do not reliably disappear when one tab closes, and browser session restore can preserve them. Sign out on shared devices.

Optional cookies and your choice

banana_preferences — With preference consent, stores language, appearance, and text size for up to 180 days. It contains no message content. It is Secure in production and SameSite=Lax, but readable by the interface because it supplies display settings.

banana_analytics — With analytics consent, stores a random first-party identifier for seven days. It is Secure, HttpOnly, and SameSite=Lax. The server counts one visit per identifier, general page category, and UTC day. It does not add email, user ID, message text, full URLs, IP address, or third-party advertising IDs to analytics records. Daily totals expire within eight days; deduplication keys expire in seven days. These counts are approximate, not a complete record of visits.

Essential only does not enable either optional category. You can reopen Cookie settings and withdraw consent at any time; optional cookies are then removed. Do Not Track and Global Privacy Control disable analytics collection. Cookie categories overlap: a cookie can be first-party, persistent, essential, Secure, and HttpOnly at the same time.

Browser storage is separate

Banana also uses local storage, session storage, and IndexedDB in your browser. These are not sent as cookies with each request. Your workspace recovery copy, display preferences, and unsent chat or file drafts can remain in local storage. IndexedDB can hold media blobs needed to restore saved assets. The Remember me checkbox decides whether authentication storage persists across browser visits on your device or lasts only for the browser session.

Supabase's browser SDK still uses that browser storage for workspace authentication. The additional HttpOnly cookie secures Banana's server session identifier; it does not move or hide the SDK's existing browser tokens. Keep your device secure and do not share sign-in links or tokens.

Clearing Banana's site data in your browser can remove these local copies and sign you out. It does not automatically erase content already synced to your account. Use the workspace controls to delete an item from the synced workspace. If you block all browser storage, sign-in persistence, recovery copies, and some media features may stop working properly.

Managing cookies

You can view or delete Banana cookies in your browser's site settings. Removing the notice cookie makes the notice appear again. Legacy image-quota and Pro cookies are no longer used and can be deleted.

We will update this page if the cookies used by Banana change. For a cookie question, email synquara@techie.com. Read the Privacy policy for more about account data, AI requests, providers, and your choices.